diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml
index 9365d09..f3bcd5b 100644
--- a/.github/workflows/standard-build.yaml
+++ b/.github/workflows/standard-build.yaml
@@ -281,6 +281,18 @@ jobs:
           platforms: ${{ inputs.platforms }}
           build-args: ${{ inputs.build-args }}
 
+      # a crashed BuildKit daemon only shows up as "error reading from server: EOF"
+      # in the build output - its own logs and container state show why it died
+      # (e.g. a Go panic vs. being OOM-killed).
+      - name: Show BuildKit daemon logs
+        if: ${{ failure() }}
+        env:
+          BUILDKIT_CONTAINER: buildx_buildkit_${{ steps.setup-buildx.outputs.name }}0
+        run: |
+          docker inspect --format 'restarts: {{.RestartCount}}, running: {{.State.Running}}, exit code: {{.State.ExitCode}}, OOM killed: {{.State.OOMKilled}}' "${BUILDKIT_CONTAINER}" || true
+          sudo dmesg | grep -i -E 'out of memory|oom-kill|killed process' | tail -n 5 || true
+          docker logs --tail 300 "${BUILDKIT_CONTAINER}" 2>&1 || true
+
       - name: Upload container image
         if: ${{ github.event_name == 'pull_request' && inputs.enable-upload-image == true }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/Dockerfile b/Dockerfile
index 808bc9e..2b61703 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,7 +19,10 @@ RUN echo "Hello test"
 
 FROM gcr.io/distroless/python3-debian13:nonroot@sha256:8ee214843129f43e2ebf5e0ca9f2e4e6d8292143d1b8a6787f169b5898578884
 WORKDIR /app
-COPY --from=base /app/hello_world.py .
+# copied from the build context rather than `--from=base`: with the final stage
+# depending on base, BuildKit v0.32.2 nondeterministically hung and crashed
+# while "preparing build cache for export" (mode=max registry cache).
+COPY src/hello_world.py .
 USER 65532:65532
 # the distroless python image's entrypoint already is the python interpreter
 CMD [ "/app/hello_world.py" ]